SSL Not using full chain - Caused partial error - aaPanel - Hosting control panel. One-click LAMP/LEMP.

SSL Not using full chain - Caused partial error

toaitran

Recently, I got an issue with SSL, everything is working fine, but on some of the application, the SSL generated by aaPanel will cause an error: error 60: SSL certificate problem: unable to get local issuer certificate

This, is caused by aaPanel not using fullchain.pem that returned by Letsencrypt, so my suggestion is to use fullchain.pem for this, it would work perfectly.

Thanks

aapanel_power

toaitran Hello, thank you very much for your feedback, can you tell me under what circumstances this error occurs? We have recently received feedback from other users and are currently working on this issue. Can you tell me under what conditions this error 60: SSL certificate problem can be triggered?

toaitran

aapanel_power Usually, it comes from server-to-server connections (on client-side - browser to server is fine), like Facebook use Curl, Discord use Curl, NodeJS applications use Axios - Fetchs...to connect between 2 application through domain name, then the error appear.

mark1175

Had the same problem (Wasn't able to access my website via wget command). Copying the content of /www/server/panel/vhost/letsencrypt/domain/fullchain.pem, pasting it into /www/server/panel/vhost/cert/domain/fullchain.pem, and restarting the nginx solved the problem. Seems like aaPanel truncates the fullchain.pem given by lets encrypt, leaving out only the first cert. @aapanel_power

aaP_mk

Same under CentOS 8 fresh install with panel/plugin/mail_sys/cert/domain.com/fullchain.pem file. Thanks @mark1175 for solution.

aaP_alin_rzv

Same issue, @mark1175 fix is working. Any updates regarding the buggfix for this issue ?
@aaPanel_Kern

Edit: checked it on a new setup server and all seems fine.

aaPanel_Kern

aaP_alin_rzv
Hi, on the newly setup server it is normal? What is the version of aapanel of your old server, if it is not 6.8.23 please update it.

aaP_alin_rzv

The certificate is not trusted in all web browsers. You may need to install an Intermediate/chain certificate to link it to a trusted root certificate. Learn more about this error. The fastest way to fix this problem is to contact your SSL provider.

This issue still not fixed ? i' using latest version of the panel , new added website, signed ssl ...
This is the same reason people are crying about e-mails could not be sent & received, yet is sent away from mail server send email option ...

aaPanel_Kern

aaP_alin_rzv
Hello, can't handle this problem. suggest using other certificates. Or consult Let's Encrypt